Chapter 25: Apps, agents, and the new rails
Open your phone. The app that holds your paycheck, the app you split dinner with, and the app that holds your index funds probably look about the same: clean screens, friendly fonts, a balance in big numbers. Behind those matching screens sit completely different machines. One sits on top of a bank. One sits on top of a broker. One may sit on top of nothing at all.
A polished app is not the product. The product is the plumbing underneath: who holds the money, what your legal claim is, and what happens on the worst day. This chapter teaches you to check the plumbing in about five minutes, and to use the newest tools, including AI, without handing over your judgment.
The eight questions before you trust any platform
Every account in your life sits with a custodian, the institution that actually holds the asset on your behalf. The app is the doorway; the custodian is the vault. Before you move real money anywhere, get answers to these:
- Who actually holds the asset? A bank, a broker, the company itself, or you?
- What is my legal claim? An insured deposit, securities in my name, or an IOU from a company?
- What insurance applies? FDIC, SIPC, or none? (Chapter 3 covers what each protects.)
- Who eats fraud losses? If someone drains the account, am I made whole?
- Can my access freeze? Locked accounts and frozen withdrawals happen. What's the process?
- What happens if the provider fails? Bankruptcy of the app should not mean loss of your money; confirm it.
- Who handles complaints? A regulator and a phone number, or just a chat bot?
- How do they get paid? If you can't find the fee, you may be the product.
If a platform can't answer these in plain English on its own website, that silence is your answer.
Payment apps are not bank accounts
Money sitting in a payment app's stored balance is often not a bank deposit. The Consumer Financial Protection Bureau has warned that balances held inside payment apps may lack deposit insurance, and the companies behind them are not banks. Some apps offer pass-through insurance: FDIC coverage that only applies if the app actually parks your money at a real bank, in records that name you. That word "if" is doing heavy lifting: the protection depends on the app's paperwork being right, and it usually does not cover the app company itself failing.
FDIC coverage per depositor, per bank, per ownership category, backed by the federal government.
What may be guaranteed if the conditions for pass-through coverage aren't met. Read the fine print.
Treat payment apps as hallways, not vaults. Move balances to an insured bank account on a schedule (weekly is fine) and keep only what you'll spend soon.
Stablecoins: a payment rail, not a savings account
A stablecoin is a digital token designed to hold a steady value, usually $1, by claiming to keep reserves behind every token. As a payment rail, the technology has real uses: transfers that settle in minutes, around the clock, across borders, often for pennies. As a place to store savings, the risks are just as real:
- Reserves. The $1 promise is only as good as what actually backs it, and how often that's audited.
- Redemption. Can you swap tokens for dollars, or only big institutions? Through whom, and how fast?
- Platform risk. The exchange or app holding your tokens can fail, freeze withdrawals, or get hacked.
- Keys. If you hold tokens yourself, losing the password (the private key) means losing the money. There is no fraud department.
- Finality. Most transfers can't be reversed. Sellers love that. Fraud victims don't.
No FDIC or SIPC stands behind any of it. A useful payment tool is not automatically a savings vehicle: the same lesson as payment apps, with higher stakes.
AI agents and your money: authority in steps
AI tools can now read accounts, categorize spending, draft plans, and increasingly take actions. The question is not whether to use them but how much authority to grant, and in what order. Give an agent authority the way you'd train a new employee: in stages, with limits, and with receipts.
Read-only access
The agent watches: tracks spending, flags fee changes, spots a forgotten subscription. It can see, not touch. Start every tool here.
Drafts, not decisions
The agent proposes: "move $400 of idle checking to savings," "your card's rate jumped." You approve or decline each one.
Small, reversible, logged
The agent executes routine moves inside hard limits you set, say transfers under $500, only between your own accounts. Every action lands in an audit log you can read, and a kill switch revokes access instantly.
The irreversible list
Some choices stay human, always: opening accounts at new institutions, sending money to anyone new, selling concentrated stock, exercising options, claiming Social Security, changing beneficiaries, signing loans. These belong on the deliberation lane from Chapter 5, with a waiting period, not an algorithm.
Here is Finvest's own stance, stated plainly: AI should do the work; you keep the judgment. Gathering, calculating, monitoring, and drafting are labor, and software should eat it. Deciding what your money is for, what risks you'll carry, and who you'll trust is judgment, and it isn't for rent.
Grant an AI agent the least authority that saves you real time, raise it one level only after it has earned trust at the current one, and never delegate a decision you couldn't undo.
Scam resistance: the new cons use old buttons
Technology upgraded the props, not the play. The Federal Trade Commission warns that scammers now use AI to clone a family member's voice from a short audio clip, then call you, sounding exactly like your grandchild or sibling, in trouble and needing money now. The script is ancient: urgency, fear, secrecy. The voice is just better.
Renee's mother got a call that sounded precisely like Renee's nephew: crying, in jail two states away, begging her not to tell anyone and to buy gift cards. It had every red flag, so the family plan kicked in: hang up, call the nephew back on his real number. He answered from his couch. Renee had set up two defenses in advance: a verification phrase (a private code word no scammer could know) and a standing rule that no money moves on an inbound call, ever. Total cost of the defense: one family dinner conversation. It protected her mother, the two younger relatives she supports, and her $9,000-a-year support budget from becoming a scammer's payday.
Your household protocol, in four lines:
- Verification phrase. Agree on a code word with family. No phrase, no money.
- Call-back rule. Hang up and call the person, or the company, on a number you already have. Never the number the caller gives you.
- The four red flags. Gift cards, crypto, wire transfers, secrecy. Any one of these means scam until proven otherwise. No legitimate authority is paid in gift cards.
- Slow is safe. Real emergencies survive a ten-minute verification. Manufactured ones don't.
Lock the doors that matter
Three cheap defenses block most account takeovers:
- Multi-factor authentication (MFA) is a second proof of identity (a code or app prompt) on top of your password. CISA, the federal cybersecurity agency, calls enabling it one of the most effective steps you can take. Turn it on for every financial account, starting with email, the master key to password resets.
- A password manager is an app that generates and stores a long, unique password for every site, so one leaked password can't unlock your life.
- A credit freeze is the free lock on your credit file from Chapter 8, which blocks scammers from opening new accounts in your name. Freeze all three bureaus; thaw only when you apply for credit.
New rails will keep arriving: faster payments, new tokens, smarter agents. The eight questions don't expire. Ask who holds the asset, what your claim is, and who pays on the worst day, and you can evaluate a platform that hasn't been invented yet.
Key takeaways
- An app's design tells you nothing; its custody and insurance layers tell you everything. Ask the eight questions before money moves.
- Payment-app balances are often not insured deposits, so sweep them to a real bank on a schedule.
- Stablecoins are a payment rail with real risks (reserves, redemption, platforms, keys, finality), not a savings vehicle.
- Give AI agents authority in steps (observe, recommend, act within caps) and keep the irreversible decisions human. AI does the work; you keep the judgment.
- Defeat voice-clone scams with a family verification phrase, a call-back rule, and the four red flags: gift cards, crypto, wires, secrecy.
- MFA, a password manager, and credit freezes are the cheapest insurance you'll ever buy.
Sources: FTC: Scammers use AI to enhance family-emergency schemes · CISA: Turn on MFA · CISA: Use strong passwords · FDIC: Understanding deposit insurance · SIPC: What SIPC protects